* 🎨 Apply pending Rector/PHP-CS-Fixer fixes
Drift left over from the auto-cs-fix.yml run that failed to open its
PR due to an expired BOT_TOKEN.
* 🐛 Fix code quality workflow and add PR-level style check
- Rotate the sweep's push credential from BOT_TOKEN (expired) to
FOSSBILLING_BOT_TOKEN, a fresh fine-grained PAT scoped to just this
repo (contents, pull-requests, issues: read/write).
- Factor the shared Rector/PHP-CS-Fixer setup out of auto-cs-fix.yml
into a local composite action, .github/actions/php-quality-setup.
- Add code-quality-check.yml: a read-only dry-run check that runs on
every pull request, including forks, scoped to just the files each
PR changes so pre-existing drift on main can't fail an unrelated
PR. Complements the scheduled sweep, which now only needs to catch
drift from rule/tool-version changes on code no open PR touches.
* 🎨 Replace peter-evans/create-pull-request with gh CLI
Removes the third-party Action dependency for opening the sweep's PR
in favor of the officially-maintained gh CLI, which ships preinstalled
on GitHub-hosted runners:
- gh auth setup-git wires GH_TOKEN into git's credential helper, so
plain git push/fetch authenticate without a hand-rolled
http.extraheader (what silently broke with the old BOT_TOKEN).
- chore/cs-fix is fully regenerated every run, so there's no need to
diff against existing remote content — force-with-lease push plus
gh pr list/create covers create-or-update.
- Also more portable: the same script runs unchanged outside GitHub
Actions' action-invocation model (other CI, cron, a terminal),
whereas a third-party Action cannot.
- Top-level permissions trimmed to contents: read — nothing in the
job uses the implicit GITHUB_TOKEN anymore.
* 🔒 Pin 1password/load-secrets-action to v5.0.1 by SHA
Was floating on the mutable @v4 tag, inconsistent with every other
third-party action in this repo (all pinned by commit SHA), and a
version behind — v5.0.1 is current as of last week and includes
1Password's own CI hardening. No breaking changes for our usage
(OP_SERVICE_ACCOUNT_TOKEN path is untouched; v5.0.0 only adds an
alternative OIDC auth method).
* 🎨 Remove unused create_pr operation output
Set in both branches but never read — the job summary only uses
.outputs.url, and the same created-vs-updated info is already in the
step's own log output.
* 🐛 Fix two Rector rules that generate code breaking Pest
CI on PR #4206 caught these — I'd only run php -l (syntax check) on
the earlier drift-cleanup commit, not the actual test suite, and both
slipped through:
- AddArrowFunctionReturnTypeRector typed Pest expect()-chain closures
as their IDE-only @mixin stub (Pest\Mixins\Expectation) instead of
the real runtime class (Pest\Expectation) — throws a TypeError.
- ArrowFunctionDelegatingCallToFirstClassCallableRector converted a
Pest ->with() dataset closure to a first-class callable reference,
which breaks Pest's Closure::bindTo() lazy-evaluation step (no scope
to rebind on a closure derived from a plain function).
Both only misfire against Pest's dynamic patterns in tests/, so
they're skipped there specifically rather than repo-wide — src/ keeps
the benefit. Reverts the two bad transformations and re-verifies with
the full Pest suite this time, not just php -l.
* 🎨 Apply Rector fixes for drift introduced by #4205
RecastingRemovalRector: three redundant (string) casts, plus one
PHP 8.3 typed-const/literal-return-type modernization in
CacheFactory.php — all from files #4205 touched after this branch
forked from main.
Verified with the full suite this time (2812 tests, 10979 assertions)
and PHPStan, not just php -l.
* 🎨 Fix import order in rector.php
Caught by the new PR check itself — it passes rector.php as one of
the changed files, so PHP-CS-Fixer processes it directly (path-mode
override), unlike the scheduled sweep whose Finder never scans
repo-root config files at all.
* 🔒 Fix script-injection risk and stale fetch ref from CodeRabbit review
- code-quality-check.yml: the changed-file list was interpolated via
${{ steps.changed_files.outputs.files }} directly into a run: script.
That's literal text substitution before bash parses anything, so a
PHP filename containing shell metacharacters (or just a space) could
break argument parsing or execute as a command. Fixed by writing the
NUL-delimited path list to a file and reading it back into a real
bash array with mapfile in every step that needs it — only a plain
boolean (has_php_files) now crosses the ${{ }} boundary. Verified:
a space-containing filename was silently split into two broken
arguments under the old design; the array-based version preserves
it as one element.
- auto-cs-fix.yml: pin the fetch to update the actual remote-tracking
ref (refs/remotes/origin/chore/cs-fix), not just FETCH_HEAD, so
--force-with-lease always has a real baseline to compare against.
* 🔒 Add option-terminator before changed-file paths
A filename beginning with '-' would otherwise be parsed as a Rector/
PHP-CS-Fixer CLI option rather than a path. Not currently reachable
given rector.php/.php-cs-fixer.dist.php scope to src/ and tests/ (a
repo-relative diff path always has that prefix), but zero-cost to
harden regardless. Verified the composed composer script -- ... -- ...
invocation forwards the second terminator correctly.
* 🎨 Apply Rector/CS-Fixer fixes for drift introduced by #4204
readonly on Registrar_Rdap::$httpClient (verified: only ever assigned
in the constructor), PHP 8.3 typed consts, redundant @param mixed
removal, pre-increment style. Verified with the full suite (2854
tests, 11055 assertions) and PHPStan.
* Improve type safety, auth checks and PHPStan fixes (#3250)
* Improve type safety, auth checks and PHPStan fixes
* Remove @phpstan-ignore annotations
* Improve type safety, auth checks and PHPStan fixes
* Remove @phpstan-ignore annotations
* Remove redundant @phpstan-ignore comment
* Improve code robustness and reliability (#3248)
* Harden code against null/undefined values
* Update dependency lockfiles
* Sanitize ticket input and use IDs in email list
* Restructure tests and add test utilities
* Move E2E tests to `Library\E2E` namespace
* Update `php-build` action ref in workflows
* Switch tests to Pest and add test scaffolding
* Refactor E2E tests to Pest-style tests
m
Skip E2E tests when env not configured
* Refactor Unit tests and update test config
Add test datasets and refine test helpers
* Add DEBUG guard, fix API JSON decode, update tests
* Refactor tests: add types and Mockery expectations
* Adjust tests, phpstan config, and composer script
* Instantiate test APIs locally, remove beforeEach
* Refactor runtime checks, types & logging
* Apply PHP Code Styling Changes
m
* Add PHPStan ignores, test renames & small fixes
* Enable Pest tests in CI workflow
* Remove legacy tests; add new unit tests/config
* Avoid undefined index in fingerprint comparison
* Ignore properties absent in both fingerprints
* Remove public_ticket_create API method
* Add Fingerprint unit tests
* Remove em dash from fingerprint test name
* Switch to Pest; assorted bug fixes & refactors
* Prefer getDi() and guard DEBUG define
* Refactor tests: DBAL, Antispam rename, helpers
* Refactor email tests to use Doctrine entities
* Update tests, use DBAL mocks & improve Formbuilder admin
* Validate plan_id and update unit tests
* Replace error_log with DI logger and update tests
* Expect db->store in Invoice Service test
* Use DI logger instead of error_log; fix tests
* Fix typo in Hook Service test
* Fix Staff test spelling fixture
* Complete Pest test migration
* Fix Product test spelling fixtures
* Fix Product test spelling fixtures
* Run live tests with Pest and load helpers
* Migrate tests to ApiClient; remove legacy APIHelper
* Fix Email test spelling
* Remove unused PHPUnit bridge
* Organize Cypress end-to-end tests
* Document Pest test directory root
* Remove noisy Pest comments
* Refactor tests to replace depreciated functions
* Update Rector config and dependencies
* Rector: Add explicit string casting for stricter type safety
* Rector: Add return type hints to methods across codebase
* Rector: Increase dead code level and refactor invoice item logic
* Remove unnecessary `willReturn` from test mocks
Eliminate redundant `willReturn(null)` and similar calls from PHPUnit mock setups in legacy module tests, leaving only method expectations. Also update some test values to use floats for consistency.
* Refactor API controller and email adapter return values
* Update formatting and guidelines in `AGENTS.md`
* Update CI for PHP 8.4
* Update composer deps for PHP 8.4
* Updates
* This is the default mode and this constant causes test failutes
* Explicily install the PDO extensions
* Temporarily downgrade the live tests to PHP 8.3
It would seem that there is some kind of problem with PHP 8.4 in regards to these tests. I believe it is outside of our control however as it installs fine for me with PHP 8.4 under DirectAdmin
* Update to address deprecations
* Make that nullable
* Fixed my typo
* Bump PHPunit to v11
* Also take care of two minor things
* Formatting fix
* Fixed our Rector config. Closes#2272
* Much improved the product configuration page
Fixed a bug and significantly improved the visuals for that page
* Place the period text after the cost
Closes#2242
* Misc changes
* Slightly shrunk the addon buttons, updated cspell
* Bumped the Rector deadcode level
* Added the instanceof setlist
* Increasded type coverage and updated tests config too
* Bumped type coverage & ran PHP-cs-fixer
* Added the rector cache to the action
* Enabled PHP-CS fixer for the tests & library folder
* Use the PHP-CS-Fixer Cache
* Fix the tests
* Ensure the Sentry placeholder isn't messed up from CS changes
* Typo..
* Update rector config to include tests
* Run Rector against the tests
* Delete test-results
* Update .gitignore
* Correctly set the PHP min to 8.1, split the configs
* Corrected PHPDoc
* Deleted tests we can't really get to pass
PHPunit is hard-coded to fail when a class has a return type of `never`, which is the correct return type of our redirect function (and rightfully so).
No way to disable the exception as far as we can tell
* Bump minimum PHP version to 8.1
* Missed these too
* Shit's broke and stupid as fuck
* Update SentryHelper.php
* Update package-lock.json
* I did the fixing
---------
Co-authored-by: Belle Aerni <belleaerni@gmail.com>
Adam Daley